Fiabilise le core et met à jour les dépendances

.env.prod.example

@@ -6,6 +6,9 @@
 # Bot token from the Discord Developer Portal.
 DISCORD_TOKEN=
 
+# Optional: fatal, error, warn, info (default), debug, trace or silent.
+LOG_LEVEL=info
+
 
 # PostgreSQL credentials — DATABASE_URL is assembled from them in the compose
 # file, so the database is never reachable from outside the internal network.

.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           run_install: false
       - name: Read Node version from .mise.toml
@@ -52,7 +52,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           run_install: false
       - name: Read Node version from .mise.toml
@@ -78,7 +78,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       # amd64 only here: the arm64 half of the release build runs under QEMU and
       # is far too slow to sit on every pull request. `publish` covers both.
       # Each build gets its own cache scope — they would otherwise overwrite one
@@ -90,6 +90,7 @@ jobs:
           target: runtime
           platforms: linux/amd64
           push: false
+          load: true
           tags: omnibot:ci
           cache-from: type=gha,scope=ci-runtime
           cache-to: type=gha,mode=max,scope=ci-runtime
@@ -103,9 +104,26 @@ jobs:
           target: migrator
           platforms: linux/amd64
           push: false
+          load: true
           tags: omnibot-migrator:ci
           cache-from: type=gha,scope=ci-migrator
           cache-to: type=gha,mode=max,scope=ci-migrator
+      # Building is not enough: a CMD pointing at a missing file builds fine and
+      # only fails at start. Apply the migrations, then start the bot with a
+      # dummy token — reaching Discord's token check proves the whole import
+      # graph loads from the production image.
+      - name: Smoke-test the images
+        run: |
+          docker network create smoke
+          docker run -d --name pg --network smoke -e POSTGRES_PASSWORD=ci postgres:17.11-alpine
+          until docker exec pg pg_isready -U postgres; do sleep 1; done
+          url=postgresql://postgres:ci@pg:5432/postgres
+          docker run --rm --network smoke -e DATABASE_URL=$url omnibot-migrator:ci
+          set +e
+          out=$(timeout 60 docker run --rm --network smoke -e DISCORD_TOKEN=ci -e DATABASE_URL=$url omnibot:ci 2>&1)
+          set -e
+          echo "$out"
+          echo "$out" | grep -q TokenInvalid
 
   # Publishing lives in this workflow rather than its own so it can depend on the
   # checks: a separate workflow triggered by the same tag would run *beside*
@@ -155,7 +173,7 @@ jobs:
           platforms: linux/arm64
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to GHCR
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

.github/workflows/docs.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
 
       - run: pnpm install --frozen-lockfile --filter omnibot-docs
 

.mise.toml

@@ -1,5 +1,5 @@
 [tools]
 node = "24.21.0"
 pnpm = "11.24.0"
-pitchfork = "2.13.1"
-gh = "2.94.0"
+pitchfork = "2.29.0"
+gh = "2.102.0"

AGENTS.md

@@ -60,4 +60,4 @@ Copy `.env.example` to `.env`:
 
 - `DISCORD_TOKEN` — bot token from Discord Developer Portal
 - `DATABASE_URL` — PostgreSQL connection string (default matches `compose.yaml`)
-- `LOG_LEVEL` — optional log level (`fatal`/`error`/`warn`/`info`/`debug`/`trace`/`silent`, default `debug`); invalid values fall back to `debug`
+- `LOG_LEVEL` — optional log level (`fatal`/`error`/`warn`/`info`/`debug`/`trace`/`silent`, default `debug` in development, `info` otherwise); invalid values fall back to that default. Logs are pretty-printed in development and JSON otherwise

Dockerfile

@@ -138,4 +138,4 @@ USER omnibot
 # would be worse than none — see the Deployment section of README.md.
 
 ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["sh", "-c", "node ./bootstrap/validate-env-vars.mjs && exec node ./dist/index.js"]
+CMD ["sh", "-c", "node ./bootstrap/validate-env-vars.ts && exec node ./dist/index.js"]

bootstrap/validate-env-vars.ts

@@ -3,7 +3,8 @@
 // Let's just crash before starting if missing
 // values.
 //
-// Runs under tsx (see the `dev`/`start` scripts), so the single dev-mode
+// Runs under tsx in dev and under Node's native type stripping in production
+// (see the `dev`/`start` scripts and the Dockerfile), so the single dev-mode
 // definition in `#lib/env.js` can be imported instead of duplicating the
 // "development" literal here.
 import { isDevMode } from "#lib/env.js";

compose.prod.yaml

@@ -78,6 +78,7 @@ services:
     environment:
       DISCORD_TOKEN: ${DISCORD_TOKEN:?DISCORD_TOKEN is required}
       DATABASE_URL: *database_url
+      LOG_LEVEL: ${LOG_LEVEL:-info}
     depends_on:
       postgres:
         condition: service_healthy

package.json

@@ -2,7 +2,7 @@
   "name": "omni-bot",
   "version": "0.1.0",
   "private": true,
-  "description": "",
+  "description": "Modular Discord bot whose modules are installed per guild",
   "keywords": [],
   "license": "GPL-3.0-or-later",
   "author": "",
@@ -17,7 +17,7 @@
   "scripts": {
     "build": "pnpm prisma:generate && tsc",
     "dev": "NODE_ENV=development node --conditions=development --env-file=.env --import tsx ./bootstrap/validate-env-vars.ts && NODE_ENV=development node --conditions=development --env-file=.env --import tsx src/index.ts",
-    "start": "node --import tsx ./bootstrap/validate-env-vars.ts && node ./dist/index.js",
+    "start": "node ./bootstrap/validate-env-vars.ts && node ./dist/index.js",
     "test": "vitest run",
     "test:unit": "vitest run --project unit",
     "test:integration": "vitest run --project integration",
@@ -33,20 +33,20 @@
     "@napi-rs/canvas": "^1.0.9",
     "@prisma/client": "^6.19.3",
     "discord.js": "^14.27.0",
-    "i18next": "^26.3.1",
-    "pino": "^10.3.1",
-    "pino-pretty": "^13.1.3"
+    "i18next": "^26.4.2",
+    "pino": "^10.3.1"
   },
   "devDependencies": {
     "@commitlint/cli": "^21.0.0",
     "@commitlint/config-conventional": "^21.0.0",
-    "@types/node": "^24.0.0",
-    "lefthook": "^2.1.9",
-    "oxfmt": "^0.67.0",
+    "@types/node": "^24.19.1",
+    "lefthook": "^2.1.16",
+    "oxfmt": "^0.71.0",
     "oxlint": "^1.12.0",
+    "pino-pretty": "^13.1.3",
     "prisma": "^6.19.3",
     "tsx": "^4.20.5",
-    "typescript": "^5.9.2",
+    "typescript": "^6.0.3",
     "vitest": "^4.1.8"
   },
   "packageManager": "pnpm@11.24.0"